1.0.3
ci: add attestations permission for build provenance attest-build-provenance requires `attestations: write` to persist the attestation (the earlier run failed with "Resource not accessible by integration"). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>